CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-103995Lenient parsing of integers for response body and chunk framingPython Software Foundation CPython
- CVE-2026-116691MLflow CrewAI autologging records LLM provider API keys in logged trace spansmlflow
- CVE-2026-112352Sunhillo SureLine Authentication Bypass via Session CookieSunhillo SureLine
- CVE-2026-112351Sunhillo SureLine OS Command Injection via networkDiag.cgiSunhillo SureLine
- CVE-2026-112350Sunhillo SureLine Path Traversal via radarUpdater.cgiSunhillo SureLine
- CVE-2026-116690MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow
- CVE-2026-116689follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsfollow-redirects
- CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5 · @ckeditor/ckeditor5-engine
- CVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5 · @ckeditor/ckeditor5-engine
- CVE-2026-116686Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasmodelcontextprotocol python-sdk · mcp
- CVE-2026-116685Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesmodelcontextprotocol python-sdk · mcp
- CVE-2026-112355MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST APIMembershipWorks
- CVE-2026-116684Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource servermodelcontextprotocol python-sdk · mcp
- GHSA-F897-62HF-6GXQMCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length@modelcontextprotocol/sdk · @modelcontextprotocol/server +2
- CVE-2026-116683CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesctfer-io terraform-provider-ctfd · github.com/ctfer-io/t… +1
- CVE-2026-118180Matrix homeserver could redirect the chat session to a local file or network shareMozilla Thunderbird
- CVE-2026-118179Request forgery via news: linksMozilla Thunderbird
- CVE-2026-118178RSS feed could redirect its subscription to a local file or network shareMozilla Thunderbird
- CVE-2026-118177Calendar discovery accepted local file and remote network share locationsMozilla Thunderbird
- CVE-2026-118176Bypass of remote UNC path restriction in mailbox: URLsMozilla Thunderbird
- CVE-2026-118175Content of other messages could be included when replying to a crafted messageMozilla Thunderbird
- CVE-2026-118174Displaying a message could load an attacker-chosen URL through an OpenPGP key attachmentMozilla Thunderbird
- CVE-2026-118173MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcementmisp-guard
- CVE-2026-115413AWS API MCP Server OAuth Token Audience Validation Bypassaws-api-mcp-server
- CVE-2026-118171CVE-2026-118171Strapi Open Source and Enterprise Headless CMS
- CVE-2026-118172CVE-2026-118172Strapi Open Source and Enterprise Headless CMS
- CVE-2026-118170CVE-2026-118170Strapi Open Source and Enterprise Headless CMS
- CVE-2026-57202Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writesasterisk · certified-asterisk
- CVE-2026-57188Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handlingasterisk · certified-asterisk
- CVE-2026-116682FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directorygtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…